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Introduction 


1. The Freedom of Information Act 2000 (FOIA) gives rights of 
public access to information held by public authorities. 


2. An overview of the main provisions of FOIA can be found in The 
Guide to Freedom of Information. 


3. This is part of a series of guidance, which goes into more detail 
than the Guide, to help public authorities to fully understand 
their obligations and promote good practice. 


4. This guidance explains when and how to refuse a request made 
under the Freedom of Information Act. 


Overview 


e Public authorities have two basic duties under FOIA; to confirm 
or deny whether requested information is held and to provide the 
requester with that information. If a public authority is refusing 
to meet either of these duties it will usually need to issue a 
refusal notice to the requester explaining why. 


e Ifa public authority intends to refuse a request on the grounds 
that it is subject to an exemption in Part II of the Act, or would 
exceed the cost limits under section 12, then it must always 
issue the requester with a refusal notice informing them of its 
decision. 


e A public authority relying on a claim that section 14 applies must 
issue a refusal notice unless it has already done so in response 
to an earlier vexatious or repeated request from the same 
individual, and it would be unreasonable to issue another one. 


e The refusal notice will need to state the section of FOIA being 
relied upon and in most instances explain the reasons for its 
decision, including the details of any public interest and prejudice 
tests. 


e If the public authority has an internal complaints procedure then 
the refusal notice must provide the requester with the relevant 
details. 


The refusal notice must inform the requester of their right to 
complain to the Information Commissioner. 
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The public authority should issue its refusal notice no later than 
20 working days after the date of receipt of the request. 


If the public authority needs further time to consider the public 
interest test then it can issue an initial refusal notice explaining 
why the exemption applies and giving an estimated date by 
which the public interest test will be completed. Once the public 
interest test has been completed then, if the public authority still 
intends to withhold information, it will need to issue a further 
refusal notice explaining its application of the public interest test. 


Where the requester has asked for their own personal data, we 
would expect the public authority to treat this as a subject 
access request under the Data Protection Act 1998, rather than 
issuing a refusal notice under section 40(1) of the FOIA. 


What FOIA says 


5. 


When a public authority receives a request made under the 
Freedom of Information Act then it must either: 


ə provide the information to the requester; 


e write back to the requester to inform them that the 
information is not held; 


° refuse to confirm or deny whether information is held; or 
e confirm that information is held but refuse to provide it. 


If the public authority refuses to confirm or deny whether 
information is held, or refuses to provide information, then it 
will usually need to send the requester a refusal notice 
explaining why. 


A public authority may only refuse a request if the information 
is subject to an exemption in Part II of the Act, would exceed 

the appropriate cost limits under section 12 or is vexatious or 
repeated under section 14. 
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Explaining why the request has been refused 


8. The refusal notice should firstly make clear that the request 
was considered under the Freedom of Information Act 2005. 


9. Public authorities should not make assumptions about the 
requester’s level of background knowledge when drafting a 
refusal notice. It is therefore good practice to use plain English 
and avoid the use of jargon or abbreviations whenever 
possible. 


Refusing a request because of a Part II exemption 


10. Sections 17(1) and 17(3) state: 


(1) A public authority which, in relation to any request for 
information, is to any extent relying on a claim that any 
provision of Part II relating to the duty to confirm or deny is 
relevant to the request or on a claim that information is 
exempt information must, within the time for complying with 
section 1(1), give the applicant a notice which— 


(a) states that fact, 
(b) specifies the exemption in question, and 


(c) states (if that would not otherwise be apparent) why the 
exemption applies 


(3) A public authority which, in relation to any request for 
information, is to any extent relying on a claim that subsection 
(1)(b) or (2)(b) of section 2 applies must, either in the notice 
under subsection (1) or in a separate notice given within such 
time as is reasonable in the circumstances, state the reasons 
for claiming - 


(a) that, in all the circumstances of the case, the public 
interest in maintaining the exclusion of the duty to confirm or 
deny outweighs the public interest in disclosing whether the 
authority holds the information, or 


(b) that, in all the circumstances of the case, the public 
interest in maintaining the exemption outweighs the public 
interest in disclosing the information. 
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11. Further guidance on how to apply the exemptions in part II of 
the Act can be found in our Guide to Freedom of Information. 
The guide includes explanations of the differences between 
class and prejudice based exemptions and qualified and 
absolute exemptions. It also includes an explanation of how the 
exclusion from the duty to confirm or deny works in practice. 


12. If a public authority is refusing a request because it has 
decided that a Part II exemption applies then its refusal notice 
will usually need to include the following information: 


o The exemption(s) on which the authority is relying, 
including section, subsection, and wording of the 
exemption concerned. 


e The reasons why the exemption applies. 
AND, where applicable 


2 A breakdown of the public interest factors which were 
taken into account. 


e The reasoning behind the authority’s conclusion that the 
public interest lay in maintaining the exemption. 


13. The explanation in the refusal notice should be detailed enough 
to give the requester a real understanding of why the public 
authority has chosen not to comply with the request. This will 
usually mean explaining the following things in some detail: 


e ifa prejudice based exemption has been claimed, exactly 
how disclosing the information, or confirming or denying 
whether it is held, would lead to the prejudice set out in 
the exemption; or 


e ifa class based exemption has been claimed, exactly how 
the information requested, or confirmation or denial that 
would need to be provided, meets the test set out in the 
exemption 


e When the exemption is qualified by a public interest test, 
all the matters taken into consideration and an 
explanation of why the public interest has been found to 
favour withholding the information or refusing to confirm 
or deny whether it is held. 


14. In most cases it will be possible to do this without any problem. 
There should be relatively few cases where it isn’t possible to 
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15. 


16. 


17. 


18. 


19. 


explain in detail why an exclusion from the duty to confirm or 
deny has been applied or why the information has been 
withheld. 


In the few cases where it would undermine the purpose of 
claiming the exemption to explain why the request has been 
refused, section 17(4) of the Act allows this detail to be left out 
of the refusal notice. 


Section 17(4) states: 


(4) A public authority is not obliged to make a statement 
under subsection (1)(c) or (3) if, or to the extent that, the 
statement would involve the disclosure of information which 
would itself be exempt information. 


If the reasons for the decision are particularly complex or 
several exemptions were applied then it may be advisable to 
split the notice into shorter subsections to make it easier for 
the requester to follow. 


Refusing a vexatious or repeated request 


Further guidance on when a request can be considered to be 
vexatious or repeated can be found in the Guide to Freedom of 
Information or via our Guidance Index. 


Sections 17(5) and 17(6) state: 


(5) A public authority which, in relation to any request for 
information, is relying on a claim that section 12 or 14 applies 
must, within the time for complying with section 1(1), give the 
applicant a notice stating that fact. 


(6) Subsection (5) does not apply where 
(a) the public authority is relying on a claim that section 14 
applies, 


(b) the authority has given the applicant a notice, in relation 
to a previous request for information, stating that it is relying 
on such a claim, and 


(c) it would in all the circumstances be unreasonable to expect 
the authority to serve a further notice under subsection (5) in 
relation to the current request. 
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20. 


2i. 


22. 


23: 


24. 


25. 


26. 


Under section 17(5), a public authority relying on a claim that 
section 14 of the FOIA applies will usually need to issue a 
refusal notice stating that the request has been refused on the 
grounds that it is vexatious or repeated. 


There is no requirement for the authority to provide the 
requester with any further explanation of why it has reached 
this conclusion. Public authorities may wish to consider 
providing more explanation, but will need to judge whether is 
likely to help matters or make them worse. 


Section 17(6) of the Act allows a public authority not to issue 
a refusal notice at all when both the following conditions are 
met: 


G the public authority has already given the same person a 
refusal notice for a previous vexatious or repeated 
request; and 


e it would be unreasonable to issue another one. 


The ICO will usually only consider it unreasonable to issue a 
further notice when an authority has previously warned the 
requester that it will not respond to any further vexatious 
requests on the same or similar topics. 


Refusing a request because answering it would exceed 
the costs limit 


Further guidance on how to establish whether a request 
exceeds the costs limit can be found in the Guide to Freedom of 
Information or via our Guidance Index. 


Sections 17(5) states: 


(5) A public authority which, in relation to any request for 
information, is relying on a claim that section 12 or 14 applies 
must, within the time for complying with section 1(1), give the 
applicant a notice stating that fact. 


If a public authority is refusing a request under section 12 then 
it must send the requester a refusal notice stating that the 
request is being refused under section 12 because compliance 
would exceed the appropriate cost limit. 
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27. 


28. 


29, 


30. 


3i. 


There is no statutory requirement under section 17 for the 
refusal notice to include an estimate of the costs involved, or 
any other explanation of why the cost limit would be exceeded. 


However, although there is no requirement under section 17(5) 
for the refusal notice to provide further explanation, public 
authorities have a duty under section 16 of FOIA to provide 
requesters with advice and assistance. 


Section 16 states: 


(1) It shall be the duty of a public authority to provide advice 
and assistance, so far as it would be reasonable to expect the 
authority to do so, to persons who propose to make, or have 
made, requests for information to it. 


(2) Any public authority which, in relation to the provision of 
advice or assistance in any case, conforms with the code of 
practice under section 45 is to be taken to comply with the 
duty imposed by subsection (1) in relation to that case. 


The section 45 Code of Practice states: 


(14) Where an authority is not obliged to comply with a 
request for information because, under section 12(1) and 
regulations made under section 12, the cost of complying 
would exceed the “appropriate limit” (i.e. cost threshold) the 
authority should consider providing an indication of what, if 
any, information could be provided within the cost ceiling. The 
authority should also consider advising the applicant that by 
reforming or re-focusing their request, information may be 
able to be supplied for a lower, or no, fee. 


The Commissioner considers that the best way to meet this 
requirement will usually be to include a breakdown of the costs 
involved in meeting the request, and an indication of what 
could be provided under the limit, as part of the refusal notice. 


Information about the appeals procedure 


32. Section 17(7) states: 
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33. 


34. 


35. 


36. 


37. 


(7) A notice under subsection (1), (3) or (5) must 


(a) contain particulars of any procedure provided by the public 
authority for dealing with complaints about the handling of 
requests for information or state that the authority does not 
provide such a procedure, and 


(b) contain particulars of the right conferred by section 50. 


The refusal notice must state whether or not the public 
authority has an internal review procedure through which the 
requester can appeal its decision. 


Although there is no statutory requirement to offer an internal 
review under the FOIA, we recommend that all authorities 
should have an appeals procedure in place so that they 
conform to FOIA Section 45 Code of Practice guidelines. 


If the authority does offer an appeals procedure then it must 
provide the details in its refusal notice to include: 


Contact information for the relevant department or 
member of staff. 


An outline of the appeals process. 


Timescales for dealing with complaints. 


Further information about the internal review process is 
available from our guidance pages. 


The notice must also advise the requester of their right to 
make a complaint to the Commissioner and should include the 
relevant contact details for the ICO. 


Time limits for issuing a refusal notice 


38. A public authority must issue its refusal notice as soon as 
practicable and within the time limit provided at section 10 of 
the Act. The time limit for most public authorities is 20 working 
days after the date they receive a request, but a public 
authority should not wait until the 20* day to respond if it can 
reasonably provide the notice earlier. 


39. 


Some public authorities are subject to a different time limit (for 
example schools don’t have to count school holidays as working 
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40. 


41. 


42. 


43. 


44, 


days). For more detail on this please refer to The Freedom of 


Information (Time for Compliance with Request) Regulations 
2004. 


Time extensions to consider the public interest test 


Section 17(2) states: 


(2) Where- 


(a) in relation to any request for information, a public 
authority is, as respects any information, relying on a claim- 


(i) that any provision of Part II which relates to the duty 
to confirm or deny and is not specified in section 2(3) is 
relevant to the request or 


(ii) that the information is exempt information only by 
virtue of a provision not specified in section 2(3) and 


(b) at the time when the notice under subsection (1) is given 
to the applicant, the public authority (or, in a case falling 
within section 66(3) or (4), the responsible authority) has not 
yet reached a decision as to the application of subsection 
(1)(b) or (2)(b) of section 2 , 


The notice under subsection (1) must indicate that no decision 
as to the application of that provision has yet been reached 
and must contain an estimate of the date by which the 
authority expects that such a decision will have been reached. 


There is provision within the Act for a public authority to claim 
an extension to the statutory 20 working day limit. 


This extension may be claimed where the authority requires 
more time to determine whether or not the balance of the 
public interest lies in maintaining the exemption 


An authority may also claim an extension if it needs additional 
time to consider whether it would be in the public interest to 
confirm or deny whether the information is held. 


The Act does not set a specific limit on the amount of 
additional time the public authority can take to consider the 
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45. 


46. 


47. 


48. 


49. 


test, only stating that the notice communicating its final 
decision must be provided within ‘such time as is reasonable in 
the circumstances’. 


Our position is that a public authority should take no more than 
an additional 20 working days to consider the public interest, 
which means that the total time spent dealing with the request 
should not exceed 40 working days. 


Where the authority does require an extension of time, it must 
issue an initial refusal notice, within 20 working days, 
explaining why the exemption applies and giving an estimated 
date by which the public interest test will be completed. 


It is important to remember that the extension only gives extra 
time to consider the public interest test. A public authority 
cannot claim additional time to consider whether the 
exemption(s) are engaged. 


Once the authority has come to a final decision about the public 
interest then it must either: 


e disclose the relevant information to the requester; OR 


e issue a notice explaining why it has found that the public 
interest to be weighted in favour of maintaining the 
exemption/neither confirming or denying that the 
information is held. 


In effect, therefore, the authority may need to issue two 
refusal notices; the first to explain that an exemption is 
engaged and to advise that the public interest test is still being 
considered, and the second to communicate its final decision. 
Both notices should provide details of the appeals procedure 


Dealing with a request for the requester’s own personal 
data 


50. 


5i. 


Section 40(1) of the FOIA exempts public authorities from the 
requirement to make available any information which is also 
the requester’s own personal data. 


However, we would not usually expect a public authority 
receiving such a request to issue a refusal notice under Section 
40(1) the FOIA. Rather we would expect the public authority 
to advise the requester within 20 working days that it intends 
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to treat the request as a subject access request (SAR) made 
under the Data Protection Act 1998. 


52. The requester should not be required to submit a separate 
information request, although as with any SAR, the authority 
will be entitled to write back to the requester if it requires 
further identification or a fee before it can process the request. 


53. Sometimes requests are made for a broad category of 
information that includes some of the requester’s own personal 
data and some other information. In this situation, if some of 
the ‘other’ information is being refused under a different FOIA 
exemption, it will make sense for the refusal notice to also 
explain that the applicants own personal data is exempt under 
section 40(1) FOIA and will be dealt with under the Data 
Protection Act. 


54. More information about how to deal with a request for personal 
information can be found in our Guide to Data Protection. 


The benefits of issuing a good refusal notice 


55. There are a number of benefits to providing as much 
explanation as possible when issuing refusal notices. 


e It will help to enhance the authority’s reputation. 


° The authority may receive fewer applications for internal 
review, because the requester will have a better 
understanding of why their request has been refused. 


G This should in turn result in fewer complaints being made 
to the Commissioner about the handling of requests. 


ə When investigating a complaint, the Commissioner may 
consider the quality and timeliness of a refusal notice, 
including how well the application of any exemptions has 
been explained. 


e If an appeal is made to the Information Tribunal against a 
decision notice, the tribunal may consider the quality of 
the authority’s refusal notice. 


e It will help the authority to conform to the section 45 Code 
of Practice. 
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More information 


56. This guidance has been developed drawing on ICO experience. 
Because of this it may provide more detail on issues that are 
often referred to the Information Commissioner than on those 
we rarely see. The guidance will be reviewed and considered 
from time to time in line with new decisions of the Information 
Commissioner, Tribunals and courts. 


57. It is a guide to our general recommended approach, although 
individual cases will always be decided on the basis of their 
particular circumstances. 


58. If you need any more information about this or any other 
aspect of freedom of information, please contact us: see our 
website www.ico.gov.uk. 
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